Virus Issues again

[Barry Beckham]

Just a heads up that a virus issue seems to have reared it's head again, this time with BullGuard. Someone has just reported to me that one of my slide shows seems to have developed a virus overnight

Its the same false positive we have seen many times with other virus software and I am sure the new virus definitins will put it right soon, but people will pannick about this as usual.

[Igor]

Thanks, Barry! I'll check up.

[TJR]

I preface my remarks by emphasising that I a a new user of PTE. There is obviously a strong and loyal user base contributing to this forum and I do not intend to be provocative. Having made those points, I would be interested to hear PTE users' (calm rational and realisitic)experiences of having thier presentations corrupted and re-circulated with malicious intent and how this can be avoided in practice. While I appreciate that virus threats are a fact of internet life well beyond PTE, my offline discussions with colleagues raise concerns about the use of .exe files. It has been pointed out to me that a presentation could be cracked, corrupted with a trojan and recirculated, and I wouldn't know which was the original and which was not. Perhaps the obvious advice is 'Don't circulate exe files'. I would be interested in comments that go beyond the obvious 'Be careful! and will be grateful to hear views and advice as I am interested in using PTE for illustrated voice-over training materials.

Regards,

TJR

[Ken Cox]

Always keep a template and or a zip of the complete show - tho a pita it is easy to recreate the exe if necessary -- i rarely make an exe unless necessary, then delete it .

ken

[Peter S]

If you really do not want to circulate exe files you can always turn your material into DVDs. You will not get the same picture quality but you and the users of your material will avoid the "exe risk".

Kind regards

Peter

[fh1805]

I preface my remarks by emphasising that I a a new user of PTE. There is obviously a strong and loyal user base contributing to this forum and I do not intend to be provocative. Having made those points, I would be interested to hear PTE users' (calm rational and realisitic)experiences of having thier presentations corrupted and re-circulated with malicious intent and how this can be avoided in practice. While I appreciate that virus threats are a fact of internet life well beyond PTE, my offline discussions with colleagues raise concerns about the use of .exe files. It has been pointed out to me that a presentation could be cracked, corrupted with a trojan and recirculated, and I wouldn't know which was the original and which was not. Perhaps the obvious advice is 'Don't circulate exe files'. I would be interested in comments that go beyond the obvious 'Be careful! and will be grateful to hear views and advice as I am interested in using PTE for illustrated voice-over training materials.

Regards,

TJR

TJR,

Since becoming an active member of this forum in 2007 I have seen no references at all by any member to any deliberate attempt (successful or otherwise) to corrupt any exe file created by PTE.

The truth is that the forum members do not "circulate" their PTE sequences. They upload them to either their own web servers (as is the case with the likes of Lin Evans, Barry Beckham and TheDom) or to servers operated by reputable File Hosting Service companies such as MediaFire. Other individuals (such as myself) can then download a copy of the sequence from the server using the details that have been posted here on the forum.

The use of exe files for AV sequences is eminently sensible as it then requires no special software to run the sequence on another computer.

We are each responsible for protecting our own PCs from harmful influences. Provided that sensible precautions are taken (e.g. a router, a firewall, anti-virus and anti-malware software) and provided that they are used in an appropriate manner, being Internet connected is, to my mind, one of the least hazardous things that I do. I've been Internet connected since the late 1990s and have, touch wood, never had any malicious infection of any kind on any PC that I have owned. And I know of only two instances amongst my family and friends of malicious infection - both caused by the unsound practice of opening attachments on unsolicited e-mails.

regards,

Peter

[Barry Beckham]

TJR

I think Peter has said it all really and I agree with him. In my experience of PTE, which is considerable, I have never heard of one instance of this either. With the greatest of respect to you, some peoples paranoia and fear of viruses far outweigh the actual threat. I would say, ignore some of the scaremongers and relax.

If we on this forum who are sharing PTE shows all the time have never suffered a virus problem, what is the issue. Please don't allow an error by a virus protection software program be the cause of an irational fear.

Here is a question I always think about when I hear of peoples fear of a virus. How come in some 15 years of being on line I have never had any issues with a virus. Am I just lucky? I doubt it, I just use common sense and a virus protection program and they has worked for me for years.

[Lin Evans]

Hi TJR,

The actuality is that we have never had an instance (to the knowledge of anyone on this forum) in over seven years of a corrupted PTE file distributing a virus, trojan or other malware.

The assumption that video files are exempt from virus or trojan (or any file for that matter) is erroneous. For a dedicated hacker, corrupting a video file is as easy as corrupting an executable file. There is a totally irrational fear, partly created by Microsoft, that executable files are somehow more "dangerous" and subject to malware than other formats. PTE uses internal file security on executable creations which prevent or at least strongly "protect" the executable code created from intrusion by hackers. This is done in the same way that Microsoft and other major players do it to prevent their own executable code from being corrupted. All application software is driven by executable code. There is far less likelihood that a PTE file will become corrupted and hacked for circulation than that you will receive malware through your email with Outlook, etc.

In the end, it's the responsibility of the user to test incoming files to minimize the probability of infection. I think that seven years of successful use of PTE's executable code without a single report of a virus or infection of any kind speaks very highly for not only the integrity of the PTE executable with it's own protection, but for the common sense of users.

In short, I believe that the fears of PTE files being corrupted are irrational and certainly not substantiated by any verifiable evidence.

Best regards,

Lin

[Igor]

Tom,

Yes, by default all created slideshows in executable files (EXE) are protected against modification.

If a virus infect a slideshow, it will not work/play and user will see a text warning that EXE file is damaged or infected.

[Ed Overstreet]

I guess this forum is where I should post my latest false positive, I think, of a virus warning from Norton Anti-virus. I've been using PTE since 2003 and this is the first time I've seen this.

I have a folder of PTE shows that I created in January 2005 (I no longer recall what version of PTE I was using then, but it was the latest version at that time). I ran my monthly NAV scan of my system this afternoon, and NAV deleted every PTE show in that particular folder (and only that folder, which is a subfolder in a larger folder containing all my PTE shows), telling me each of the shows in that subfolder was infected with Backdoor.trojan.

I have had that folder on my system (two copies actually, one each on two external hard drives) since 2005 and NAV has NEVER given me a warning of a virus infection on those files until today. I scan my system once a month, so my system has been scanned by NAV probably about 60 times since January 2005 and this is the first time NAV has done this to me.

Fortunately I have backups of those EXEs on a DVD-R, so I can recopy from that DVD-R (made about 12 months ago). However, when I try to run any of the restored copies, the same thing happens, NAV clobbers not only the file I tried to launch but also all the other files in that particular subfolder.

NAV is not doing this to any of my more recent PTE shows on the same system.

If I temporarily disable NAV I can launch and run any of these "suspect" shows with no problem.

So I assume there is something wonky with Symantec's Backdoor.trojan definition that was issued in the past four weeks or so as a regular update, that is causing this problem with these particular shows from 2005.

Has anyone else run into this?

PS I'm out of town for a week starting Thursday morning so won't be following this thread for a few days after tomorrow; I'll pick it up again next week when I return. However I will check it once or twice in the next 24 hours and reply if necessary for any follow-up.

PPS This is the first time since I got this system in 2004 that I have had ANY virus-infection warnings from NAV. I never connect to the internet without Norton Firewall and Norton Anti-Virus being active, moreover my internet service provider has a very effective virus program that quarantines infected spam mail before I ever see it; I get a weekly report of all the quarantined emails from them so I know how many have been sent to me (and also which "spam" emails weren't actually spam but were false positives, so I can download those). Like Barry, I am very cautious about suspicious emails, I don't troll through dodgy websites, and I've never had a virus infection on my PC since I got my first one back in 1988. So I'm 99.44% certain the problem I've identified above is a false positive from Symantec and not a problem with my PTE shows ... but even so it's a pain to have to disable my internet connection and then disable NAV before I can run any of the 2005 shows mentioned above. Maybe someone should complain to Symantec, but I'm not technically-inclined enough to know what to say to them about this (and in past experience I find they are singularly not helpful when dealing with people like me who aren't software engineers like them )

[Ken Cox]

ED

I MOVED YOUR THREAD

ALSO SEE

http://www.picturestoexe.com/forums/index.php?showtopic=11088

ken

[Ed Overstreet]

ED

I MOVED YOUR THREAD

ALSO SEE

http://www.picturestoexe.com/forums/index.php?showtopic=11088

ken

Hi Ken. thanks for the cross-reference; where did you move my post, I can't find it there ...

[Ken Cox]

Hi Ken. thanks for the cross-reference; where did you move my post, I can't find it there ...

ED

2-3 entries up on this page

ken

[Gérard de Lux]

Another series of "false positives" virus alarms by AVAST antivirus has recently been reported on our DiaporamaForum. If this happens to you, do not react to AVAST warning; they have been informed by our forum member but I don't know when they will react.

[Ed Overstreet]

I'm going away for a few days, when I return I'll update my NAV virus definitions and check to see if NAV is still giving me the backdoor.trojan warning on those old PTE shows. If so, I'll send a copy of one of them to Symantec with a polite suggestion their definitions are returning a false positive and asking them to fix it. If not, then it probably means Symantec found the problem and fixed it with an update to the definitions, likely without telling anyone as this sort of thing doesn't exactly inspire confidence in the anti-virus software Either way I'll post an update on my experience in this thread.

BTW I was wondering this morning why about 2 GB of space had disappeared from my C drive overnight, until I did a search in Windows Explorer for all new files in the past week and discovered NAV had "kindly" quarantined multiple copies of the "infected" PTE files, which accounted for almost all the "missing" space on the hard drive. Deleted the quarantined files and all is back to normal on my hard drive ... A word to the wise ...

[Barry Beckham]

Here we go again.

The new Virus definitions have just been downloaded for my Avast Virus protection program and it appears to be picking up every PTE slide show, old and new.]

I have had to disable Avast to play anything.

This is becoming tedious and I have sent the attached mail to Avast

The new virus definitions downloaded to my PC this morning contain an error. Avast is picking up every slide show I have ever made, some years old, right up to one I made this morning as having a virus. They don't and it is a problem that has been experienced with other virus programs. The slide shows are the products of www.wnsoft.com and most of the Photographic world use this software, so I expect people are panicking all over the place right now. If you want a quick sample download my show made this morning from the link below and check it out for yourselves. http://www.beckhamdigital.co.uk/downloads/pte6/textonapath/textonapath.zip If you can correct this quickly we would all be grateful Barry Beckham

[Barry Beckham]

This is actually worse than I thought, with Avast anti virus software running you can't even open the PTE 6 program, you will need to close Avast protection first.

This will have a lunatic fringe frothing at the mouth

[Barry Beckham]

Later 7pm Aussie time recieeved this email from Avast

Hello,

false positive was fixed in new VPS update (091203-1).

Sorry for any inconvenience.

Milos Hrdy

Virus analyst

[Ed Overstreet]

I'm back from my trip. When I updated my NAV virus definitions on my return, the update files were a LOT bigger than I remember them being (for whatever that's worth). After updating the definitions, I temporarily disabled NAV, copied all the PTE shows on which NAV had given a false "backdoor.trojan" positive to a separate folder, re-activated NAV and then launched each show. No problem, no warning, NAV is no longer giving me any grief on these shows (for now, anyway). From which I infer that either I am very lucky, or that maybe Norton has quietly fixed the problem. I hope.

If the problem recurs, I'll update further.